1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:
Julian Kowalewski
c/o Impressumservice Dein-Impressum
Stettiner Straße 41
35410 Hungen
Germany
Email:
Contact Form: To Contact Form
2. Overview of Data Processing & Purpose
The Flow app is designed for task and schedule planning. To provide its features, enable cross-device synchronization, and support collaboration in shared categories, we process personal data.
3. Local Data Processing on the Device
To ensure core functionality and offline usability, data is stored locally on your device:
- Local Database & Preferences (SQLite, SharedPreferences): Tasks, categories, app settings, due-status tracking.
- Legal Basis: Art. 6(1)(b) GDPR (performance of a contract for app usage) and relevant national telemedia/telecommunications laws.
4. Use of Cloud Services (Google Firebase)
We use services provided by Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA) for synchronization, authentication, and cloud functions.
a. Firebase Authentication (User Account)
- Processed Data: User ID (UID), email address, authentication tokens, registration/login timestamps. If third-party sign-in services are used (Google Sign-In, Sign in with Apple), we receive the email address or identifier provided by the respective provider. Anonymous accounts use a randomly generated ID.
- Purpose: Task association, account security, and user authentication.
- Legal Basis: Art. 6(1)(b) GDPR.
b. Cloud Firestore & Cloud Storage
- Processed Data: Task content, due dates, creation and edit dates, assigned categories, group memberships, interactions (e.g., completions/reactions), user settings, and optionally uploaded profile pictures.
- Purpose: Providing real-time synchronization and cloud storage of tasks and profile media.
- Legal Basis: Art. 6(1)(b) GDPR.
c. Firebase Cloud Functions
- Processed Data: Task and user data processed during automated backend workflows.
- Purpose: Executing server-side logic (e.g., recurrence interval calculation, notification cleanup, and account deletion procedures).
- Legal Basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.
5. Push Notifications (Firebase Cloud Messaging & APNs)
If you have consented to receive push notifications, we use Firebase Cloud Messaging (FCM) and, for iOS devices, the Apple Push Notification service (APNs) (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland).
- Processed Data: Anonymized push tokens of your device, notification contents (e.g., reminders for due tasks or shared category activities).
- Purpose: Delivering alerts and updating the app badge.
- Legal Basis: Art. 6(1)(a) GDPR (consent). You can revoke this permission at any time in your device settings.
6. Data Transfer to Third Countries
Your data may be processed on servers owned by Google LLC and Apple Inc. in the United States. Data transfers are based on the EU-U.S. Data Privacy Framework (DPF) as well as the EU Commission’s Standard Contractual Clauses (SCCs).
7. Storage Period and Data Deletion
- Local Data: Automatically deleted from your device upon uninstalling the app.
- Account & Cloud Data: You can request account deletion at any time directly in the app under “Profile”. Once requested, the account is scheduled for deletion and permanently removed by an automated cloud function. All associated tasks, group memberships, notifications, reactions, and profile photos are irrevocably deleted.
8. Your Rights as a Data Subject (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure / “Right to be forgotten” (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
To exercise your rights, please contact us at .
9. Changes to this Privacy Policy
We reserve the right to update this privacy policy to ensure compliance with legal requirements or to reflect changes in our services.
Last updated: May 2024